Tue Jan 28 21:07:13 UTC 2014patches/packages/bind-9.9.4_P2-i486-1_slack14.1.txz: Upgraded. This update fixes a defect in the handling of NSEC3-signed zones that can cause BIND to be crashed by a specific set of queries. NOTE: According to the second link below, Slackware is probably not vulnerable since we aren't using glibc-2.18 yet. Might as well fix it anyway, though. For more information, see: https://kb.isc.org/article/AA-01078 https://kb.isc.org/article/AA-01085 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591 (* Security fix *)patches/packages/mozilla-nss-3.15.4-i486-1_slack14.1.txz: Upgraded. Upgraded to nss-3.15.4 and nspr-4.10.3. Fixes a possible man-in-the-middle issue. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1740 (* Security fix *)+--------------------------+

Sat Feb 1 00:56:38 UTC 2014patches/packages/cairo-1.12.16-i486-1_slack14.1.txz: Upgraded. This is a bugfix update that was tested in -current and found to resolve some outstanding issues with the package that shipped in Slackware 14.1. Removed --enable-xcb-shm (may cause instability with GTK+3). Removed --enable-xlib-xcb (causes GIMP slowdown). Added --enable-ft and --enable-gl.+--------------------------+

Thu Feb 13 23:45:53 UTC 2014patches/packages/curl-7.35.0-i486-1_slack14.1.txz: Upgraded. This update fixes a flaw where libcurl could, in some circumstances, reuse the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS request. For more information, see: http://curl.haxx.se/docs/adv_20140129.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015 (* Security fix *)patches/packages/ntp-4.2.6p5-i486-5_slack14.1.txz: Rebuilt. All stable versions of NTP remain vulnerable to a remote attack where the "ntpdc -c monlist" command can be used to amplify network traffic as part of a denial of service attack. By default, Slackware is not vulnerable since it includes "noquery" as a default restriction. However, it is vulnerable if this restriction is removed. To help mitigate this flaw, "disable monitor" has been added to the default ntp.conf (which will disable the monlist command even if other queries are allowed), and the default restrictions have been extended to IPv6 as well. All users of the NTP daemon should make sure that their ntp.conf contains "disable monitor" to prevent misuse of the NTP service. The new ntp.conf file will be installed as /etc/ntp.conf.new with a package upgrade, but the changes will need to be merged into any existing ntp.conf file by the admin. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211 http://www.kb.cert.org/vuls/id/348126 (* Security fix *)+--------------------------+

Thu Feb 20 00:30:49 UTC 2014patches/packages/gnutls-3.1.21-i486-1_slack14.1.txz: Upgraded. This update fixes a flaw where a version 1 intermediate certificate would be considered as a CA certificate by GnuTLS by default. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1959 (* Security fix *)patches/packages/mariadb-5.5.35-i486-1_slack14.1.txz: Upgraded. This update fixes a buffer overflow in the mysql command line client which may allow malicious or compromised database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0001 (* Security fix *)patches/packages/shadow-4.1.5.1-i486-3_slack14.1.txz: Rebuilt. Shadow 4.1.5 addressed a tty-hijacking vulnerability in "su -c" (CVE-2005-4890) by detaching the controlling terminal in the non-PAM case via a TIOCNOTTY request. Bi-directional protection is excessive and breaks a commonly-used methods for privilege escalation on non-PAM systems (e.g. xterm -e /bin/su -s /bin/bash -c /bin/bash myscript). This update relaxes the restriction and only detaches the controlling tty when the callee is not root (which is, after all, the threat vector). Thanks to mancha for the patch (and the above information).+--------------------------+

Tue Mar 11 07:06:18 UTC 2014patches/packages/udisks-1.0.5-i486-1_slack14.1.txz: Upgraded. This update fixes a stack-based buffer overflow when handling long path names. A malicious, local user could use this flaw to create a specially-crafted directory structure that could lead to arbitrary code execution with the privileges of the udisks daemon (root). For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0004 (* Security fix *)patches/packages/udisks2-2.1.3-i486-1_slack14.1.txz: Upgraded. This update fixes a stack-based buffer overflow when handling long path names. A malicious, local user could use this flaw to create a specially-crafted directory structure that could lead to arbitrary code execution with the privileges of the udisks daemon (root). For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0004 (* Security fix *)+--------------------------+

Thu Mar 13 03:32:38 UTC 2014patches/packages/mutt-1.5.23-i486-1_slack14.1.txz: Upgraded. This update fixes a buffer overflow where malformed RFC2047 header lines could result in denial of service or potentially the execution of arbitrary code as the user running mutt. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467 (* Security fix *)+--------------------------+

Fri Mar 14 00:44:48 UTC 2014patches/packages/samba-4.1.6-i486-1_slack14.1.txz: Upgraded. This update fixes two security issues: CVE-2013-4496: Samba versions 3.4.0 and above allow the administrator to implement locking out Samba accounts after a number of bad password attempts. However, all released versions of Samba did not implement this check for password changes, such as are available over multiple SAMR and RAP interfaces, allowing password guessing attacks. CVE-2013-6442: Samba versions 4.0.0 and above have a flaw in the smbcacls command. If smbcacls is used with the "-C|--chown name" or "-G|--chgrp name" command options it will remove the existing ACL on the object being modified, leaving the file or directory unprotected. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4496 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442 (* Security fix *)+--------------------------+